Stored XSS - Mutillidae
Last updated
Last updated
<script>alert(document.cookie)</script>
When user using this blog and load database records contains the script code, the malicious code will be execute on browser.
Step 1: Login to the application and navigate to http://192.168.31.112:9090/app/products
Step 2: Click "Add Product" and fill the product details. Click "submit" and intercept the request using Burp.
Step 3: Modify the "description" parameter in the POST request body to <script>alert(document.domain)</script>. Forward the request
Step 3: In the response, notice that <script>alert(document.domain)</script> is part of the HTML in the products page. Navigate to http://localhost:9090/app/products and you'll see an alert
